On how IP addresses can be the downfall
of an impersonator and hoaxer
Part Three
Conclusion
On 11th June 2013 we noticed some interesting visits to our site from someone using an iPhone on Orange Mobile.
As readers may recall from the bottom of our previous page Impersonation - Part Two, a new IP address had come on the scene showing interest in the pages that static IP address 2.102.51.133
on an iPhone using Talk Talk Wolverhampton had also shown recently.
Click on the image below to see full size version of screenshot of the visit to our Personal page at our 06:27:06h
What was curious was that the visitor had landed on our Personal page from our Legal and Copyright page but there was no hit indicated in the logs for the Legal and Copyright page. I had to wait until
today, 12th June 2013, to access the server logs for yesterday to see if there had been some sort of glitch.
On examining the Tripod/Lycos server log for that time period around 06:27:06h on 11th June 2013 we found the following
entries starting at 06:22:40h and ending at 06:22:58h. The visitor had first entered our site via UFO Casebook Proboards.
For someone who claims that none of our research and investigation bothers him he does tend to visit rather often!
Click on the image to view the full size version of the entries showing the links from UFO Casebook Proboards.
Note that the IP address was the very familiar static IP address 81.136.171.104. This was the static IP address that
has shown up in many email and message communications sent to Mr. Phil Hoyle and Xpose UFO Truth since 9th January 2013.
Those communications started just after we exposed Perks' Alamo sphere UFO Hoax. That IP address has also shown up in hundreds of entries to pages on our Xpose UFO Truth website.
The same static IP address 81.136.171.104 was exposed in the communication from "Mrs. Mary Hay" of Her Majesty's
Revenue and Customs on 6th June 2012 to Mr. Phil Hoyle.
Please see Impersonation Part One for details of that particular impersonation of an officer of H.M. Government.
Three minutes after that entry from static IP address 81.136.171.104 we find entries from someone with IP address 31.90.230.149
using an iPhone.
Click on images to view full size versions of screenshots.
Given the very close time match between static IP address 81.136.171.104 and what appears to also be a static IP address
31.90.230.149 our suspicions are that the two "visitors" are one and the same, and most likely Darren Perks on his
iPhone trying to hide his visits with Hide My Ass proxy. As there was only one other log entry between the times of
the visits of static IP addresses 81.136.171.104 and 31.90.230.149 and that was a Google Bot image, the
likelihood is quite high!
This screenshot of the transition shows the time frame. One can also see the links from UFO Casebook Proboards. Click
on the image to view the full size version of the screenshot.
It would seem from the evidence presented above that our "new" visitor using Hide My Ass proxy is more than likely
to be our loyal follower Darren Perks.
Do we have yet another visitor using Hide My Ass proxy?
We think NOT!
It was not surprising to see yet another set of Hide My Ass visits today, 12th June 2013, to our Xpose UFO Truth site.
The usual favoured pages were visited by someone using an iPhone and the Hide My Ass proxy, but this time a
different ISP showed up!
This time we found Pipex Tiscali - Migration Space - one that has appeared in many logs before now but from Wallasey
on the Wirral using an iPhone and Hide My Ass proxy.
This was the first hit to our Entry page.
Click on the image to view the full size version of the screenshot.
The iPhone visitor was quite interested in our "Impersonation" pages for some reason. He was probably waiting
to see what developments had occurred since the previous visit. Click on the image below to see full size version of the
screenshot of the visit to our "Impersonation Part Two" page.
We will have to wait until tomorrow, 13th June 2013, to access the server logs on Tripod/Lycos and see which ISP was being
used on this occasion by Hide My Ass proxy.
Will there be more visits in the future from the Hide My Ass proxy user on his trusty iPhone to check on our
investigations?
Update 13th June 2013
In order to complete the above reference regarding Pipex-Tiscali Migration Space, Hide My Ass proxy used the
ECATEL LTD ISP in the Netherlands for the aforementioned visits yesterday. This is a standard ISP used by a number
of proxy providers.
COMMENTS
Only occasionally do we see visitors using proxies but this extensive use of the Hide My Ass proxy by some user/s since
February 2013 makes us think there are individuals who really do not want their visits recorded. However, as we have found,
using Hide My Ass has been shown to be rather ineffective.
Regarding the frequently mentioned static IP address 81.136.171.104 having been used to send fake email messages and
impersonate an officer of H.M. Government among others, even though the sender eventually used the Hide My Ass
proxy, it was, unfortunately for him, a little bit too late!
There was no point in closing the barn door!
The horse, or maybe in this case the ass, had already bolted!
Update 23rd June 2013
Difficult though it might be to believe that, after all this information that has been assembled in our three-part article,
someone using "Hide My Ass" proxy is still visiting our site. The only problem with "Hide My Ass" is that it
does not seem to hide anything, certainly not the user's IP address, location and iPhone details.
It could just be that this individual has not read all our material thoroughly as yet.
We will be adding details of these visits showing that someone is possibly a tad concerned about our coverage of their activities.
Update 27th June 2013
We were quite amused today when Perks tweeted about using "Tor" and the Firefox browser that "are
very effective at stopping snooping."
Why is the UK's (and possibly the World's) leading investigative UFO researcher talking about "snooping?"
Click on the image below to view the full size version of the tweeting screenshot.
We took a screenshot of the log for this very page - Impersonation Part Three - and the following was revealed.
Click on the image below to view the full size version of the screenshot.
This visitor also looked at (but probably did not read) The Alamo Sphere, Hoaxwatch, Intellectual Property, Who Is This, The
Orange Sphere UFO, Sirius the Movie, Resources and Updates - a total of ELEVEN pages.
This persistent visiting indicates to us that, despite declarations to the contrary, someone appears to be interested in what
is written on our site but does not want his identity revealed.
Update 4th July 2013
We recently received a rather ridiculous email missive from Darren Perks via his Ymail account. Within this offering
he waffled on about how absurd it was that we were suggesting that he lives in different towns.
Obviously Perks has no clue as to how IP addresses are assigned or how IP addresses essentially show where one's ISP is located,
NOT where one's own home or office are located.
IP addresses most commonly show where the registered offices of an ISP are or where the nearest hub is located.
Laughable indeed that someone apparently so "savvy" in using the Internet to further his "Media" career, umbilically attached to an iPhone, Tweeting, posting on Facebook, writing "articles"
for his UFO Shropshire website, and obsessively checking to see the latest Perks Updates on Xpose UFO Truth,
does not understand how an IP address is assigned or what it shows regarding the user/s.
One has to wonder how he holds down a real job when he's so busy doing all these other things! :)
But despite all Perks' ramblings, the fact remains that static IP address 81.136.171.104 that appeared in various communications
from Perks to Phil Hoyle and myself, were also found to be the source IP address for impersonation of an Officer of Her
Majesty's Government Revenue and Customs and also various anonymous (or so the sender thought) communications from imaginary,
or in some cases, real people. The use of known researchers' names for various hoaxes just boggles the mind.
This static IP address 81.136.171.104 was clearly identified as belonging to that of the network at Integrity Financial Services in Shrewsbury.
Added to that, what appears to be Perks' employer's name is also displayed within the headers information of the email from
that static IP address. The screenshot of the results regarding the source IP address is shown below, and was also included
in Part One of this presentation.
Click on the image to view the full size version.
Even if a thousand or more people were using that one static IP address 81.136.171.104 at Integrity Financial Services
(as if they would have that number of staff!) - how many people would be obsessively checking the Xpose UFO Truth website
on an almost daily basis (sometimes several times per day) since 9th January 2013?
And the visits only started after Xpose UFO Truth uncovered Perks'
We have noticed that the "Hide My Ass" visits have almost ceased. Those frequent visits have been replaced with a
visitor using an Anonymous Proxy - "Tor" and the same browser, Firefox 17.0 for every visit. The screen
resolution is always the same, and the pages visited on our site are always the same as those visited by the "Hide My Ass"
anonymous proxy (that does not work) user.
Here is just one example - actually from earlier today, 5th July 2013 - where the "Anonymous Proxy" visitor checked
out Impersonation Part One. Whoever the visitor might be has fairly "regular habits" it seems, as can be seen from the entries for
the 2nd July and 5th July.
Click on the image to view the full size version of the screenshot of the page log.
And the visitor also checked out our Southern Ontario Reports page on the 2nd of July and today, the 5th of July, at almost exactly the same time on both occasions.
Click on the image to view the full size version of the screenshot of the page log.
Even though our long-time visitor (since 9th January 2013) using the "Hide My Ass" anonymous proxy (which never worked)
has almost ceased to drop by, at least someone using "Tor" and Firefox has come along to eventually take their
place.
It is good to see that our efforts to uncover the hoaxes, impersonations, plagiarisms and more do not go unappreciated.
